Business Continuity and Disaster Recovery
This domain tests whether you can keep critical services running through disruption and recover technology within agreed limits. Expect questions on business impact analysis, recovery objectives, strategies, exercises, and plan maintenance.
BCMS and BIA
ISO 22301:2019 defines a business continuity management system using plan-do-check-act. A business impact analysis identifies critical activities, dependencies, and the consequences of disruption over time. It derives the maximum tolerable downtime, minimum business continuity objective, recovery time objective, and recovery point objective. RTO is the target time to restore a service; RPO is the acceptable data loss measured in time; MTD is the maximum outage before unacceptable harm. Recovery strategies may include alternate sites, cloud regions, manual workarounds, and supplier arrangements.
DR and exercises
DR tiers range from cold standby, with space and power but no running systems, to warm standby with partial capacity, to hot standby with near-real-time capability. Backup strategy follows 3-2-1: three copies, two media, one off-site, increasingly with immutable copies. A plan that has not been exercised is an assumption. Exercise types include tabletop, simulation, component failover, and full failover. Crisis communication and staff availability are part of continuity, not an afterthought.
Worked example
Order entry supports $1.2M daily revenue, with an MTD of 24 hours. The business sets RTO at 4 hours and RPO at 15 minutes. The chosen strategy is a warm standby in a second region with asynchronous replication every 5 minutes, a documented runbook, and semi-annual failover tests. The solution costs $250k. Downtime costs about $50k per hour, so an 8-hour outage would cost $400k, exceeding the solution cost. The RPO of 15 minutes is met because replication lags at most 5 minutes, subject to testing evidence.
Traps that cost marks
- Writing a DR plan without a BIA and without business-owned recovery priorities.
- Swapping RTO and RPO.
- Assuming backups are recoverable without restore testing.
- Limiting continuity to IT and omitting people, premises, suppliers, and communications.
- Setting an RTO the budget cannot support.
- Leaving the plan static after organizational or system changes.